Alleged creator of Gozi virus suddenly released from Latvian jail

Latvia agreed to extradite him to US, but it was overruled by European court.

Deniss Calovskis, the man accused of creating the Gozi virus, has been released from a Riga, Latvia jail after being held since December 2012. The Latvian Prosecutor General’s Office announced (Google Translate) Thursday that it would let the alleged hacker go free.

Calovskis' lawyer, Saulvedis Varpins, told the Wall Street Journal that the release came out of the blue, "like an American movie where someone tells the prisoner 'you can go now.’”

In August 2013, Latvian authorities agreed to extradite Calovskis. Days later, his legal counsel appealed to the European Court of Human Rights, which blocked the extradition. Throughout, Calovskis has repeatedly denied all involvement in the Gozi virus case.

“I am like a hostage in this situation,” he said during an August 3 interview with Latvian television, according to Bloomberg. “I don’t know about the Gozi virus. I haven’t helped any schemers to get money and I haven’t received any.”

The Journal added:

Aiga Senberga, the press secretary of the Latvian Prosecutor General's office, said that the prosecution authority decided to release Mr. Calovskis from pre-extradition detention "because the purpose for pre-extradition detention no longer exists." She did not elaborate but said there would be no further legal restrictions placed on Mr. Calovskis.

"The maximum penalty for the crimes alleged would be around 10 years behind bars in Latvia, but the penalty he faces in the States actually means life imprisonment," he said. Rinkevics noted that it was not clear if Calovskis' crimes occurred in Latvia or the United States or whether the accused would be able to serve his sentence in his homeland.

Promoted Comments

So instead of serving time in either country (not including time served) they just let him go....nice. :-|

They aren't saying why he's being freed -- "More information will be provided" is what it says on the Latvian web site. Maybe evidence has come to light that exonerates him? Or maybe the Latvian president pardoned him like most U.S. presidents will for some criminals.

So instead of serving time in either country (not including time served) they just let him go....nice. :-|

They aren't saying why he's being freed -- "More information will be provided" is what it says on the Latvian web site. Maybe evidence has come to light that exonerates him? Or maybe the Latvian president pardoned him like most U.S. presidents will for some criminals.

If an alleged crime has 10 year sentence in Europe but a life-sentence in the US, then it would be a human rights violation for a European to be extradited to the US. So I'm OK with his release. It would make no sense for him to be tried in the US. He should be tried in his country instead.

After all, what if Americans were randomly accused of crime in a foreign country while living in the US and the US allows them to be extradited to that country - e.g. a middle Eastern country or Southeast Asian country. Tit for tat that wouldn't make sense.

So instead of serving time in either country (not including time served) they just let him go....nice. :-|

They aren't saying why he's being freed -- "More information will be provided" is what it says on the Latvian web site. Maybe evidence has come to light that exonerates him? Or maybe the Latvian president pardoned him like most U.S. presidents will for some criminals.

It did not say the release came from the sovereign nation holding him but from some European Court. I don't even understand how that is possible. But the European Union has been a ticking time bomb forever so why not have random courts releasing people from prison.

Um... last I checked the US has various levels of court.So does the EU. The top court is at EU level, not sovereign level. Does that really seem super outlandish to you?

Imagine the countries are like states of the US. And the EU is like the federal government.

If an alleged crime has 10 year sentence in Europe but a life-sentence in the US, then it would be a human rights violation for a European to be extradited to the US. So I'm OK with his release. It would make no sense for him to be tried in the US. He should be tried in his country instead.

uuummmm....wasn't he in jail and from the country that just released him?

If an alleged crime has 10 year sentence in Europe but a life-sentence in the US, then it would be a human rights violation for a European to be extradited to the US. So I'm OK with his release. It would make no sense for him to be tried in the US. He should be tried in his country instead.

uuummmm....wasn't he in jail and from the country that just released him?

Are they going to charge him or what?

No, he was charged in the US and being held pending extradition hearings which, if successful from the US Government's perspective, would see him flown to the US for prosecution and imprisonment. Since extradition was blocked, there was no longer a reason to hold him. The reaasons why extradition was blocked have et to be relweased, but I suspect jameskatt2 had it right regarding the mismatched sentences.

I'd guess, from reading about previous extradition cases with mismatched sentence possibilities, that the US Government refused to negotiate on that point. Shocking. *sigh*

If an alleged crime has 10 year sentence in Europe but a life-sentence in the US, then it would be a human rights violation for a European to be extradited to the US. So I'm OK with his release. It would make no sense for him to be tried in the US. He should be tried in his country instead.

uuummmm....wasn't he in jail and from the country that just released him?

Are they going to charge him or what?

No, he was charged in the US and being held pending extradition hearings which, if successful from the US Government's perspective, would see him flown to the US for prosecution and imprisonment. Since extradition was blocked, there was no longer a reason to hold him. The reaasons why extradition was blocked have et to be relweased, but I suspect jameskatt2 had it right regarding the mismatched sentences.

I'd guess, from reading about previous extradition cases with mismatched sentence possibilities, that the US Government refused to negotiate on that point. Shocking. *sigh*

So instead of serving time in either country (not including time served) they just let him go....nice. :-|

They aren't saying why he's being freed -- "More information will be provided" is what it says on the Latvian web site. Maybe evidence has come to light that exonerates him? Or maybe the Latvian president pardoned him like most U.S. presidents will for some criminals.

It did not say the release came from the sovereign nation holding him but from some European Court. I don't even understand how that is possible. But the European Union has been a ticking time bomb forever so why not have random courts releasing people from prison.

The EU courts are very limited on what they can rule on, one such thing is whether rulings violate the human rights any member state is supposed to have as legislation (which they agreed to willingly as part of joining the EU). If the extradition of him violated his human rights, as seems to be the case here, then there's no case for keeping him in prison (since he was being held pending extradition, no charges had been brought yet)

So instead of serving time in either country (not including time served) they just let him go....nice. :-|

They aren't saying why he's being freed -- "More information will be provided" is what it says on the Latvian web site. Maybe evidence has come to light that exonerates him? Or maybe the Latvian president pardoned him like most U.S. presidents will for some criminals.

It did not say the release came from the sovereign nation holding him but from some European Court. I don't even understand how that is possible. But the European Union has been a ticking time bomb forever so why not have random courts releasing people from prison.

This has nothing to do with the European Union.

The decision came from the European Courts of Human Rights (ECtHR), whose rulings apply to all countries which signed and ratified the European Convention on Human Rights (ECHR) - which are all 47 members of the Council of Europe. Only about half of them (28 countries) constitute the EU.

Both the court and the convention predate the EU (the convention was first signed in 1950, the court was established in 1959), and are recognized by countries such as Switzerland or Norway (which have chosen not to join the EU) or such as Turkey (which has been refused EU membership so far).

edit: To expand a little on this, the EU does have a court - but it's called the European Court of Justice (ECJ), and its role is very different. Also, the ECJ is bound to respect the ECHR, just like national courts in all signatory countries are.

So instead of serving time in either country (not including time served) they just let him go....nice. :-|

They aren't saying why he's being freed -- "More information will be provided" is what it says on the Latvian web site. Maybe evidence has come to light that exonerates him? Or maybe the Latvian president pardoned him like most U.S. presidents will for some criminals.

Or maybe countries are starting to see through the US BS that leads to people being detained and extradited on spurious claims that lack actual evidence.

If an alleged crime has 10 year sentence in Europe but a life-sentence in the US, then it would be a human rights violation for a European to be extradited to the US. So I'm OK with his release. It would make no sense for him to be tried in the US. He should be tried in his country instead.

uuummmm....wasn't he in jail and from the country that just released him?

Are they going to charge him or what?

No, he was charged in the US and being held pending extradition hearings which, if successful from the US Government's perspective, would see him flown to the US for prosecution and imprisonment. Since extradition was blocked, there was no longer a reason to hold him. The reaasons why extradition was blocked have et to be relweased, but I suspect jameskatt2 had it right regarding the mismatched sentences.

I'd guess, from reading about previous extradition cases with mismatched sentence possibilities, that the US Government refused to negotiate on that point. Shocking. *sigh*

Thanks Nilt...good explanation!

You bet. I have an odd hobby of listening to legal podcasts and such, considering I'm neither an attorney nor involved in the legal profession in any way. I just find it interesting how the process and system works is all.

We need sentence reform if someone can get life for that. Life is not a joking matter and the punishment needs to more accurately reflect the crime otherwise it seems barbaric.

I did a quick search on the Gozi malware, and it seems that life imprisonment may be a reasonable punishment given the impact it had. This was a serious criminal act.

I'm not sure I agree. As I understand it, there was no loss of human life due to the actions of the Gozi malware's creators. I have a very difficult time resolving, in my mind, the justice of a potential life sentence for financial damages alone. I mean, are we really saying that it's as bad as murder?

We need sentence reform if someone can get life for that. Life is not a joking matter and the punishment needs to more accurately reflect the crime otherwise it seems barbaric.

I did a quick search on the Gozi malware, and it seems that life imprisonment may be a reasonable punishment given the impact it had. This was a serious criminal act.

I'm not sure I agree. As I understand it, there was no loss of human life due to the actions of the Gozi malware's creators. I have a very difficult time resolving, in my mind, the justice of a potential life sentence for financial damages alone. I mean, are we really saying that it's as bad as murder?

Actually the penalty for me walking on the street and just killing a random person would be much less than the penalty for the crimes that they were charging him with.

We need sentence reform if someone can get life for that. Life is not a joking matter and the punishment needs to more accurately reflect the crime otherwise it seems barbaric.

I did a quick search on the Gozi malware, and it seems that life imprisonment may be a reasonable punishment given the impact it had. This was a serious criminal act.

I'm not sure I agree. As I understand it, there was no loss of human life due to the actions of the Gozi malware's creators. I have a very difficult time resolving, in my mind, the justice of a potential life sentence for financial damages alone. I mean, are we really saying that it's as bad as murder?

Actually the penalty for me walking on the street and just killing a random person would be much less than the penalty for the crimes that they were charging him with.

I'm not sure I agree unless you did it on accident. I'm reasonably sure that purposefully going onto a street and killing a random individual would carry a max of a life sentence. Now, you may or may not get such a sentence but that's a different matter. I think this goes back to the issue we saw in the Aaron Schwartz (sp?) case where they throw every possible thing at someone to encourage a plea bargain. Either way, I cannot say I disagree with the (admittedly unconfirmed) reasoning that a court sees the life sentence for the Gozi malware as drastically over-reaching.

The decision came from the European Courts of Human Rights (ECtHR), whose rulings apply to all countries which signed and ratified the European Convention on Human Rights (ECHR) - which are all 47 members of the Council of Europe. Only about half of them (28 countries) constitute the EU.

Both the court and the convention predate the EU (the convention was first signed in 1950, the court was established in 1959), and are recognized by countries such as Switzerland or Norway (which have chosen not to join the EU) or such as Turkey (which has been refused EU membership so far).

And by Russia... Which IIRC is the country that has the most cases brought against it before the ECtHR of all signatories, but generally ignores its rulings.

So instead of serving time in either country (not including time served) they just let him go....nice. :-|

They aren't saying why he's being freed -- "More information will be provided" is what it says on the Latvian web site. Maybe evidence has come to light that exonerates him? Or maybe the Latvian president pardoned him like most U.S. presidents will for some criminals.

It did not say the release came from the sovereign nation holding him but from some European Court. I don't even understand how that is possible. But the European Union has been a ticking time bomb forever so why not have random courts releasing people from prison.

How about looking it up on Wikipedia before making assumptions about what it is.

So instead of serving time in either country (not including time served) they just let him go....nice. :-|

They aren't saying why he's being freed -- "More information will be provided" is what it says on the Latvian web site. Maybe evidence has come to light that exonerates him? Or maybe the Latvian president pardoned him like most U.S. presidents will for some criminals.

It did not say the release came from the sovereign nation holding him but from some European Court. I don't even understand how that is possible. But the European Union has been a ticking time bomb forever so why not have random courts releasing people from prison.

Um... last I checked the US has various levels of court.So does the EU. The top court is at EU level, not sovereign level. Does that really seem super outlandish to you?

Imagine the countries are like states of the US. And the EU is like the federal government.

If an alleged crime has 10 year sentence in Europe but a life-sentence in the US, then it would be a human rights violation for a European to be extradited to the US. So I'm OK with his release. It would make no sense for him to be tried in the US. He should be tried in his country instead.

After all, what if Americans were randomly accused of crime in a foreign country while living in the US and the US allows them to be extradited to that country - e.g. a middle Eastern country or Southeast Asian country. Tit for tat that wouldn't make sense.

One word of advice to him: run. Living the rest of your life in hiding might be difficult, but it beats being "rendered" by the US.

Quote:

in my mind, the justice of a potential life sentence for financial damages alone. I mean, are we really saying that it's as bad as murder

Non-violent drug offenses often result in life sentences (or at least 25+ year mandatory minimums), so in the US, drug possession is prosecuted just as aggressively as murder. I would wager that stealing from financial oligarchs would be WAY more aggressively prosecuted than murder.

We need sentence reform if someone can get life for that. Life is not a joking matter and the punishment needs to more accurately reflect the crime otherwise it seems barbaric.

I did a quick search on the Gozi malware, and it seems that life imprisonment may be a reasonable punishment given the impact it had. This was a serious criminal act.

I'm not sure I agree. As I understand it, there was no loss of human life due to the actions of the Gozi malware's creators. I have a very difficult time resolving, in my mind, the justice of a potential life sentence for financial damages alone. I mean, are we really saying that it's as bad as murder?

Gozi was about stealing large amounts of money from people all over the world. It's serious crime, and while not a violent crime, theft like this leads to real problems for the victims, up to an including impoverishment.

Life imprisonment for non-violent crimes is sometimes perfectly reasonable. The line to draw is how much money results in what sort of sentence. Ripping off a few mp3s isn't worthy of any jail time, but bankrupting tens of thousands of people through fraud or outright theft definitely is.

Gozi was a serious financial crime. Serious penalties apply for those caught and found guilty.

If an alleged crime has 10 year sentence in Europe but a life-sentence in the US, then it would be a human rights violation for a European to be extradited to the US. So I'm OK with his release. It would make no sense for him to be tried in the US. He should be tried in his country instead.

After all, what if Americans were randomly accused of crime in a foreign country while living in the US and the US allows them to be extradited to that country - e.g. a middle Eastern country or Southeast Asian country. Tit for tat that wouldn't make sense.

The difference is that if there is sufficient evidence of an American citizen committing a crime, we wouldn't just release them if we decided not to extradite them, we would try them in the United States.

I'm fine with this guy being tried in Latvia. It may not be the idea situation, but it is a reasonable one. It seems strange that there was enough evidence that they were willing to extradite him, but they are now just letting him go. Maybe evidence was found that undermined the case against him, or I guess it is possible that the US government wasn't willing to provide sufficient evidence and aid to the Latvian prosecutors. I'm surprised the US government didn't just agree to a ten year cap on sentencing. It's not like hackers often get that long of sentences.

It's often difficult to estimate the exact number of computers infected by a botnet, because unless you are the botnet's operator, you are never going to have a total picture of everything that's infected. Redundant infrastructure (multiple layers of command and control servers, "bullet-proof" hosting, etc.) pretty much means that while some portions are visible, others are going to be unknown, or at least opaque, to observation.

That said, millions of computers were infected by the Gozi virus, with 25,000-40,000 (reports vary) of them confirmed as being in the United States alone. There were likely more, but as noted above, you're not going to ever figure those out unless you capture the perpetrator in the middle of running their botnet with all of their control panels open, and that's something that never seems to happen.

As far as economic damages go, this malware was used to steal at least fifty million dollars, according to the papers filed by the USDOJ. Fifty million dollars is quite a bit of money, and if this were a group of corrupt executives who had stolen this money from a company, I'm sure there would be no qualms about the types of jail sentences being bandied about, whether for punitive or deterrent reasons.

Frankly, I'm more alarmed that people seem to think criminals who just happened to use bytes instead of bullets to steal millions of dollars from folks should somehow be sentenced less harshly. While there's no doubt that some of the victims probably got what they deserved, the sheer number of victims means that a lot of hardworking folks had their bank accounts drained and experienced real financial hardships as a result.

It is all fun and games to talk about proportionality of sentencing, but what exactly is the right amount of punishment? Would you say that a single day behind bars in jail per each infected PC is fair? If that's the case, consider this: If the 40,000 infected PCs in the US equals 40,000 days, well, that's 110 years of jail. And remember, that's just the number that could be positively identified as being the United States, the actual number of infected hosts there is likely to be much higher.

Actually I have a better idea to determine a fair and reasonable punishment in said case. Either the individual of perpetuating the virus pay for service on all machines or serve time equivalent to how long it would take to repair said machines. Thus in this example if a regular Joe who uses a computer and knows nothing gets infected and has to pay $150 for said repairs and makes $12 an hour, then that roughly 12.5 hrs of jail time said hacker should (1) serve 12.5 hrs of jail time or (2) pay a fine equivalent to $150.

I really think that's a true, unbiased punishment. And if he infected dozens of thousands of computers, then said jail time should reflect an approximation of that. Obviously we all make varying degrees of income but approximations of standards do exist and should apply in these cases so no one thinks someone's just being an a@@hole of a prosecutor.

The difference is that if there is sufficient evidence of an American citizen committing a crime, we wouldn't just release them if we decided not to extradite them, we would try them in the United States.

You are making the assumption that there IS sufficient evidence.Who says the US have shared anything substantial with their Latvians counterparts?Who says that the evidence the US has would be admissible in a Latvian court?

If the Latvian authorities don't have enough to try this guy they HAVE to let him go. Keeping him locked up on the grounds that they might find something would be a violation of his rights.

This is very right motion!!! Sentences in US are nonsense and extraditing somebody who would locally get maybe only a few years and only on parole but would get 100 or 200 (or 1000) years, that is literally life time imprisonment, in US, is ridiculous.

As far as I understand (from the Latvian write-ups) what happened was :

Dennis Čalovski was arrested in Latvia, and put in prison on 4th December 2012Latvian State Police refused to start criminal proceedings as there was no crime that they had enough evidence to convict him of.The US requested extradition so he was kept in prisonThe Latvian courts twice said he could not be extradictedThe Latvian parliament voted that he would still be extradited (even though their foreign minister was against it, see the second link below)The European Court of Human Rights said they would rule on this (this would in theory over-rule the parliament)The European court would not provide their ruling until after 4th December 2013Latvian law requires that a person suspected of a crime can be held for up to one year in prison pending trial.There was no chance of a trial before the end of the year's imprisonment, so he was released.

This does not mean that he is totally free, if the Latvian government decides to continue the case through the European court, and it decided that he could be extradited, then he could be imprisoned again. Assuming they can find him.

We need sentence reform if someone can get life for that. Life is not a joking matter and the punishment needs to more accurately reflect the crime otherwise it seems barbaric.

I did a quick search on the Gozi malware, and it seems that life imprisonment may be a reasonable punishment given the impact it had. This was a serious criminal act.

I'm not sure I agree. As I understand it, there was no loss of human life due to the actions of the Gozi malware's creators. I have a very difficult time resolving, in my mind, the justice of a potential life sentence for financial damages alone. I mean, are we really saying that it's as bad as murder?

So no matter how great the damage or how many people were affected, as long as no one lost their life, they shouldn't be extradited? Because the US may be too tough on them? Well that explains all the Scam Spam I get in my mail box every day.

Actually the penalty for me walking on the street and just killing a random person would be much less than the penalty for the crimes that they were charging him with.

I'm not sure I agree unless you did it on accident. I'm reasonably sure that purposefully going onto a street and killing a random individual would carry a max of a life sentence. Now, you may or may not get such a sentence but that's a different matter.

-It all depends on where that street is located.

In Norway, murder normally carries a maximum sentence of 21 years (with provisions for keeping you locked up for longer if certain requirements are met - notably that you are mentally ill (in which case you are technically sentenced to treatment, not punishment) or if it is considered likely that you'll still be a significant hazard to society at large if you are released.)

21 years is only theoretical, by the way - after doing 2/3 of the time, you are more or less automatically released. Also, the full 21 year sentence is rarely handed down - your average, garden-variety 1st degree murder would probably net you 12-15 years, putting you back on the street in less than ten.

If an alleged crime has 10 year sentence in Europe but a life-sentence in the US, then it would be a human rights violation for a European to be extradited to the US. So I'm OK with his release. It would make no sense for him to be tried in the US. He should be tried in his country instead.

After all, what if Americans were randomly accused of crime in a foreign country while living in the US and the US allows them to be extradited to that country - e.g. a middle Eastern country or Southeast Asian country. Tit for tat that wouldn't make sense.

The difference is that if there is sufficient evidence of an American citizen committing a crime, we wouldn't just release them if we decided not to extradite them, we would try them in the United States.

I'm fine with this guy being tried in Latvia. It may not be the idea situation, but it is a reasonable one. It seems strange that there was enough evidence that they were willing to extradite him, but they are now just letting him go. Maybe evidence was found that undermined the case against him, or I guess it is possible that the US government wasn't willing to provide sufficient evidence and aid to the Latvian prosecutors. I'm surprised the US government didn't just agree to a ten year cap on sentencing. It's not like hackers often get that long of sentences.

In the case of some recent extraditions from Britain which were rejected, the US refused to share the evidence of the individual's guilt because it wasn't necessary for extradition. As far as I'm aware they never actually shared the evidence, even after appealing the decisions, so it seems likely that's the case here.